CVE-2011-4828

Autosectools V-cms - Code Injection

Title source: rule

Description

Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/.

Exploits (2)

metasploit WORKING POC EXCELLENT
by AutoSec Tools, sinn3r · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vcms_upload.rb
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotephp
https://www.exploit-db.com/exploits/18738

Scores

EPSS 0.8005
EPSS Percentile 99.1%

Classification

CWE
CWE-94
Status draft

Affected Products (1)

autosectools/v-cms

Timeline

Published Dec 15, 2011
Tracked Since Feb 18, 2026